Logsurfer: Arbitrary code execution

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 201201-04 / Logsurfer
Release Date	January 20, 2012
Latest Revision	January 20, 2012: 1
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
app-admin/logsurfer+	< 1.8	>= 1.8	All supported architectures

Related bugreports: #387397

Synopsis

A double-free flaw in Logsurfer allows a remote attacker to execute arbitrary code.

2. Impact Information

Background

Logsurfer is a real time log monitoring and analysis tool.

Description

Logsurfer log files may contain substrings used for executing external commands. The prepare_exec() function in src/exec.c contains a double-free vulnerability.

Impact

A remote attacker could inject specially-crafted strings into a log file processed by Logsurfer, resulting in the execution of arbitrary code with the permissions of the Logsurfer user.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Logsurfer users should upgrade to the latest version:

Code Listing 3.1: Resolution

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=app-admin/logsurfer+-1.8"

4. References

CVE-2011-3626

Page updated January 20, 2012

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.